CVE-2026-91141

Received Received - Intake

Memory Exhaustion via SOME/IP Length Field in vsomeip

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: CERT/CC

Description

A vulnerability in the default configuration of vsomeip allows a remote, unauthenticated attacker to trigger massive memory allocations by sending a small TCP packet with a large, attacker-declared SOME/IP length field. This can lead to immediate service termination via OOM-kill on memory-constrained systems or total host memory exhaustion through repeated connections.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-12

Last Modified

2026-11-12

Generated

2026-11-13

AI Q&A

2026-11-13

EPSS Evaluated

N/A

NVD

CVE-2026-91141

EUVD

EUVD-2026-124718

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in vsomeip's default configuration lets a remote attacker send a small TCP packet with a falsely large SOME/IP length field. This forces the system to allocate excessive memory, potentially crashing services or exhausting host memory.

Impact Analysis

It can cause service outages by triggering OOM-kills on memory-limited systems or full system crashes from repeated memory exhaustion. Attackers may disrupt critical services relying on vsomeip.

Mitigation Strategies

Update vsomeip to the latest patched version to fix the default configuration issue. Monitor network traffic for unusual TCP packets with large SOME/IP length fields. Restrict network access to vsomeip services if possible.

Hi! I’m here to help you understand CVE-2026-91141. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...